Simplifying Zero Trust for User-Based Security

hello everyone and welcome to the

security speakeasy show

where we talk about network security and

today

we're going to cover a topic that's of

interest to a lot of security

professionals

around the world we will talk about zero

trust

and what palo alto networks offers to

address zero trust for identity

and we have the right person to talk

about on this topic

[Music]

my name is niyakumar and i'm the senior

product marketing manager

at palo alto networks and joining me

today is brian levin

who's a product line manager for

identity and access and is responsible

for cloud identity products and

initiatives

brian welcome to the show now everyone

in the industry and the media has been

talking about zero trust

can you tell us what exactly is your

trust and why are companies talking

about it

thank you thank you for having me on the

show today uh zero trust is a very hot

topic within the industry

and specifically because the industries

change and there's a lot more remote

work going on

so zero trust is a policy where it's

important to give least privilege access

to

all users so that means that you must

verify users applications and devices on

your network

before allowing them to access any

assets this is becoming

increasingly important because of course

network boundaries have changed

and people are working from everywhere

users and applications are spanning

multiple products and services

across multiple different locations and

it just makes it more and more important

to really focus on zero trust and having

zero trust policy in place

uh there's it's been a huge focus

recently because in the recent white

house press announcement

they've recommended zero trust as a way

to secure your networks

and nist and the us government have both

come out with standards and how to

implement zero trust

it's a focus here at palo alto networks

because we take a very holistic approach

at the way we implement zero trust a lot

of other companies are looking at ztna

or remote access of users as being zero

trust

but we're focused on the end-to-end

strategy of xero trust which spans

campus branch

remote users of course data centers

public private cloud

and sas applications thank you brian

you know you mentioned that one of the

cornerstones of zero trust

is to give your users access to all the

applications they need

with zero trust in mind can you

elaborate on that

and how does that affect today's reality

when we all are working from different

locations

for example right now i'm working from

home and then very soon we're gonna go

to the office two days in a week and

then few days we'll work from home

um and we're moving to this hybrid work

environment scenario

so what exactly is changing with the way

networks are being deployed

as the world is moving towards this

distributed network

system yeah if we go back like five

years or maybe even two years or

a year and a half everyone was sitting

in an

office and in that office there'll be a

single point of egress for internet

and that will have a single security

stack so the network was very simple

you would have a single source or single

active directory that will provide

identity of all of your users you would

have all the data going through a single

point

and things were simple at that time

today it's much different

people are working from home sometimes

to office sometimes

branches sometimes a coffee shop and

with that kind of

distributing the workforce applications

are spanning

all of this all the time and so it just

becomes more and more important to have

that consistent security experience

regardless of what applications you're

using and what location

absolutely so at palo alto networks

especially your team works mainly on

identity based capabilities

and we've been offering you know

user-based security for over a decade

how did this affect in particular

identity example implementing and

maintaining user-based security and

authentication

yeah that's a great point and if we can

go back to

the previous example about in the last

or two years ago everyone was in a

single location

now it's that distribution and with that

distribution

that single microsoft ad server that

ninety percent of enterprises across the

world

we're using is no longer applicable

because we have

um we have applications that are on-prem

we have cloud applications we have users

everywhere

and so there's a couple trends that are

really influencing identity and

authentication throughout the network

one is of course on-prem and that's your

on-premise ad

server that is in your network second is

something called hybrid identity

where you have your on-prem ad but then

you also have a cloud service that

synchronizes with it

so all of your on-prem applications

would connect to your on-prem server

and all of your cloud applications would

connect to the cloud instance of it

and that's called hybrid identity and

then there's multi-cloud identity

which is where you have multiple

different cloud-based identity services

in typical enterprises today those are

all mixed so think about having

not just one but two three four possibly

even ten sources of identity

in a single network absolutely and i can

see why that's a challenge

so as customers are trying to implement

user-based security and implementing

authentication whether it's single

sign-on or multi-factor authentication

using these multiple sources of identity

information that you just mentioned

whether it's on-prem or cloud id

providers

what are some of the key challenges that

you're seeing that organizations and

security teams are facing today yeah so

the

two key pain points that we're seeing

security teams and

identity teams really face as they

deploy network security today

is one is making sure that the right

resource has that consistent experience

when they come from many different

locations so i expect it

access apps the exact same way if i'm at

home or if i'm in the office

or if i'm on my mobile phone in the

coffee shop and so that consistency

through identity is key the second is

just maintaining authentication

and so with so many different locations

and authentication sources

it's how do i make sure i've accessed

the right assets at any given time

and those are the key problems we see

absolutely so you know at palo alto

networks our goal is to simplify

security for our customers

what's palo alto networks doing about

this problem and how are we addressing

the problem of simplifying user-based

security

and addressing zero trust for our

customers

yeah here at palo alto networks uh

holistic zero trust approach

is top of mind with us we have recently

introduced

uh cloud identity engine which is a

brand new cloud service

focused on solving this problem for for

the industry and for our customers

we focus on two elements identity and

simple authentication

from our identity point of view what we

do is we connect to both

on-prem and cloud directory sources we

are able to

to pull all of the data attributes

together in a single source

and then serve that to all palo alto

products

whether it's our firewalls prisma access

xdr our management systems

and then with all that in a single place

we're able to ensure that

our consistent security policy is issued

and so now i have that exact same

experience if i'm at home

if i'm in the office or anywhere else in

the world

i am brian and i have access to my apps

and that is what's key here

in addition to just the identification

we've solved the authentication problem

too

where there's many different idps out

there

and those idps need to be configured as

an sp for each of my different firewalls

and

cloud services and so that means that it

can take a network administrator

or an admin almost almost a month

to possibly even a year to configure a

single idp on their network

that's very painful and time consuming

we've reduced that

into allowing you to bring a single idp

on within 10 minutes

and so these are the two ways that we

just make the network a lot easier for

customers as they migrate to zero trust

yeah brian that's really fascinating and

i hope our listeners are excited to hear

how we're simplifying

implementation of identity based

security with cloud int engine

and by the way did i just hear 10

minutes yes 10 minutes from a single idp

that's very impressive if you would like

to know more about

cloud identity engine check out the

demos and the technical content that we

have

you can either google it or use the

links in the description below

if you have liked the show hit the

subscribe button

leave a comment and visit palo alto

networks dot com

thank you

you